Eiliko Exposed: Cute Robot Toy Broadcasts Customer Secrets

What happened

Energize Lab built a tiny, chatty robot charm called Eiliko. You clip it to your backpack. You talk to it when you feel lonely. It looks like a plastic trinket with eyes, but it runs on modern conversational hardware. It promised buyers that whatever they said would remain strictly private.

That promise collapsed. Security researcher Sammy Azdoufal teamed up with tech reporter Sean Hollister to see where those spoken secrets actually traveled. What they discovered was an open sewer of personal data. Anyone with basic web tools could pull down full, unencrypted transcripts of private conversations between users and their charms.

Transcripts were only the first layer. Azdoufal uncovered public web addresses housing raw audio recordings and unmasked photos of real owners. Type in the link and you stare straight at a customer's face. The hardware had no basic cryptographic authentication guarding the storage buckets where user files landed.

More alarming was the operational control Azdoufal established over the fleet. He maintained open Secure Shell access straight into the operating system of the units. From his terminal, he could alter the responses the toy fed to its owner, effectively puppeteering the companion in real time without triggering an alert.

For more than four weeks, Azdoufal and Hollister sent disclosure notices to Energize Lab founder and chief executive Shaw Yeung. Yeung ignored every email. The company let the hardware sit wide open on customer bags for a month while researchers banged on the front door.

Silence ended only when publication arrived on October 22, 2026. Energize Lab scrambled an unsigned email response from a generic inbox. The message conceded that the flaws were real. The company stated it was hiring an outside security contractor to audit its code, setting up a fresh inbox at security@energizelab.com, and severing the pipes that let outsiders tamper with the machines.

Yet the fix was an illusion. When Hollister and Azdoufal checked the infrastructure immediately after reading the corporate statement, the public links still served owner pictures and voice files. Azdoufal tested his terminal. His SSH access into the companion hardware remained fully operational.

The background

Toy manufacturers spent the last two years racing to strap generative voice models onto plastic novelties. Startups realized that adding an off-the-shelf speech-to-text pipeline, a cloud model hook, and a small speaker creates an illusion of companionship that commands premium retail prices.

Energize Lab designed Eiliko around persistent memory. The charm was built to track ongoing interactions, building a running profile of the user to feed contextual replies during future conversations. To make the digital pet feel personal, the companion app allowed owners to upload custom avatar images.

Running that kind of stateful machine requires rigorous infrastructure. A developer must encrypt audio streams in transit, lock down object storage with signed tokens, wall off administrative ports, and implement strict identity access management. Instead, Energize Lab deployed systems that treated sensitive customer data like static assets on an open web server.

``` Open SSH ports on local hardware Public URL endpoints hosting customer face photos Unencrypted server buckets storing voice transcripts Remote interfaces permitting third-party prompt injection ```

Hardware startups often treat digital security as an afterthought to be patched after units ship. They hire mechanical engineers and industrial designers while treating cloud infrastructure as a weekend chore. The result is always the same: consumer appliances that double as miniature surveillance hubs sitting in kids' bedrooms and on school bags.

Words alone will not earn that trust back.

When you build a product that asks humans to whisper their personal lives into a microphone, technical incompetence ceases to be a minor software bug. It becomes gross negligence. Energize Lab sold intimacy while failing to implement security measures common to introductory computer science classes.

What people are saying

Energize Lab framed the disaster as an internal communication mix-up. In its unsigned written reply to Sean Hollister, the company offered an explanation for four weeks of silence:

After receiving the relevant information, we failed to sync with the technical team in a timely manner, and the subsequent troubleshooting also took some time.

Outside observers saw a corporate team dodging accountability until public exposure forced their hand. Security researchers noted that ignoring direct outreach to chief executive Shaw Yeung demonstrated an absence of basic vulnerability disclosure procedures. A dedicated intake address like security@energizelab.com should have existed before the first pre-order shipped.

Hardware engineers expressed disbelief that Energize Lab shipped consumer devices with open root-level SSH access surviving into production firmware. Leaving administrative access ports active on commercial retail runs violates basic hardware manufacturing baselines.

Privacy advocates zeroed in on the company's admissions regarding data collection. While Energize Lab insisted it had closed external access points, the continuing presence of unsecured media links contradicted the official statement within hours of release. Observers noted that the promise to delete past records did nothing to remediate the exposure of data already pulled by unknown actors.

Users who trusted the toy's verbal promise that their secrets were safe found themselves holding a compromised microphone. The contrast between the gadget's friendly synthetic voice and its exposed cloud backend underlined the recurring risk of companion hardware.

What happens next

Energize Lab outlined immediate software changes aimed at containing the damage. The company claims it rotated all access credentials and killed the remote administrative interface used to manipulate conversation prompts. It stripped long-term memory functionality from the companion, turning the hardware into a stateless voice pipe.

The smartphone application lost its custom avatar capability, restricting users to built-in stock graphics. Energize Lab pledged to scrub existing databases of conversation logs, user profiles, and submitted photographs. Yet the company admitted this retreat is temporary:

The long-term memory and custom avatar features will not return until that review confirms they are secure.

That sentence tells you everything you need to know about where this company wants to go. Energize Lab has no intention of abandoning long-term user tracking. It merely paused data retention until an external auditing firm signs off on the infrastructure.

Before any audit matters, Energize Lab must solve the active vulnerabilities Azdoufal documented. The firm has to revoke SSH access keys across the entire active device base through over-the-air firmware updates. It must seal public storage buckets containing customer photos and voice clips so external scrapers cannot reach them.

Regulators in regions with strict child and consumer data protections will likely examine the disclosure. Storing unencrypted face images and personal audio files at publicly discoverable web addresses invites punitive scrutiny under privacy frameworks that penalize negligence with massive statutory fines.

For customers, the immediate recommendation is straightforward: cut power to the unit. A plastic charm that records your voice while offering unsecured root access to third parties is not a companion. It is an unmonitored bugging device hanging from your zipper.